SOPlanning Privilege Escalation Vulnerability in User Management

A privilege escalation vulnerability has been identified in SOPlanning, affecting all versions prior to 1.55. The issue arises in the user management tab, where users with the 'user_manage_team' role can modify permissions of other users. These users are able to assign administrative rights to any user, including themselves, thereby escalating their privileges. This vulnerability impacts both the Bulk Update functionality and the regular editing of user rights and privileges.

Impact

Exploitation of this vulnerability allows authenticated users with the 'user_manage_team' role to gain administrative privileges, including the ability to assign such rights to themselves.

Remediation

Users can update to SOPlanning version 1.55 or later to address this vulnerability.